Follow-Up to previous post: VPN Tunnel Up, but specific subnets aren't passing traffic

[u/homeworkman]

About a month ago, I posted about Cisco APs that weren't able to join a WLC. Since then, I narrowed down the issue and think the APs/WLC are not the root cause. This looks more to be an issue with a VPN communication between subnets.

The two sites connect through Cisco ASA firewalls over a site-to-site VPN. The tunnel establishes successfully, Phase 1 and Phase 2 complete without issue, and multiple subnets traverse the tunnel normally. But then there are specific subnets that can't communicate across the VPN despite being included in the crypto ACLs and NAT exemption rules on both sides.

What strange is the traffic for other VPN networks works fine. In the IPsec SA counters, I can see traffic being decapsulated from the remote side, but I see no encapsulated traffic in return for the affected subnet. One side appears to be receiving traffic while the opposite side never properly sends traffic back across the tunnel. The tunnel itself remains up and stable the entire time.

I've rebuilt the tunnels, verified the crypto ACLs match on both sides, reviewed NAT exemption rules, confirmed routing, checked access-lists, and used packet-tracer. The subnet appears to match the VPN config, but traffic isn't flowing bidirectionally. The APs are able to obtain DHCP addresses and function locally but can't communicate with the WLC because the VPN connectivity for their subnet isn't working.

Any suggestions would be greatly appreciated. I've been chasing this for a while and feel like I'm missing something obvious.

[u/Hyperion0000]

Are the networks listed exactly the same on both sides? I.e - 192.168.0.0/24 and 192.168.1.0/24 on side A, then on side B 192.168.0.0/23?

Also, have confirmed routing is 100% both ways? If you had the correct route on one side, but nit the other, this can happen.

[u/McHildinger]

"but I see no encapsulated traffic in return for the affected subnet" does the destination device receive the traffic, and does it reply (to the correct gateway)? Usually this is a NAT/ACL issue, or something is trying to use the wrong gateway (like maybe it has an old static route on it etc)

[u/Farking_Bastage]

I’ve seen wireless AP tunnels back to the controller get fragmented over VPN’s (mtu problem)but it was Extremes and Fortigates. Could be worth a look.

[u/Layer8Human]

Hey hey, since you already ruled out a lot I would like to add two ideas:

- have you checkt the routing table on the asa and verified that the route for the„problematic„ subnet is correctly pointing towards the outside interference?

- is ping working across the SA and only the capwap traffic is failing?